Rogue access point detection in wireless networks

ABSTRACT

Methods to detect rogue access points (APs) and prevent unauthorized wireless access to services provided by a communication network are provided. A mobile station (MS) reports to a serving AP the received signal strength (RSS) for all APs in the area it travels. The serving AP detect a rogue AP based on inconsistencies perceived in the RSS reports, assessed during the handover phase or whilst the communication is active.

FIELD OF THE INVENTION

The invention is directed to communication networks and in particular torogue AP detection in wireless networks.

BACKGROUND OF THE INVENTION

Wireless networks are one of the fastest growing segments in theworldwide telecommunications market. In a typical wireless (radio)system, mobile subscribers are served by a series of interconnectedradio stations, or base stations, each covering a certain geographicalarea. The base stations are connected to and controlled by a mobileswitching center (MSC) which is in turn connected to the wireline (landline) public switched telephone network (PSTN). The mobile subscribersare provided with portable or mobile (car-mounted) telephone units,which are collectively called mobile stations. The base stationsrepresent the entry points, or network access points (APs).

A serious problem which has plagued wireless communications systems isfraud, which results in significant monetary losses for the respectivenetwork and service providers. To address this issue, wireless networksuse encryption for maintaining the confidentiality of the informationexchanged over the air link. Encryption however does not fully addressaccess of unauthorized mobile stations to a network to steal services(e.g. fraudulent use of mobile identification numbers, “roamer” fraud,mobile station “cloning”). A variety of verification and validationsystems were developed and installed to detect and prevent these typesof fraud. Thus, most tools for securing communications in a wirelesssystem perform authentication for confirming the identity of the mobilestation, at registration, call initiation or call reception. Since bothauthentication and encryption require communication between the remote(visited) network and the home network (where the MS has a permanentregistration) in order to obtain mobile-specific information, theauthentication of the MS is a complex and sophisticated task.

In addition to mobile fraud, one of the today's most challenging ITsecurity issue is detection and removal of illegal (fraudulent) wirelessAPs; these are generally referred to as “rogue access points (AP)”.Rogue APs are set up by malicious attackers with a view to simply denyaccess to the network, or to attract traffic towards them and obtainsensitive information from users. This can leave the assets of thecompany under attack wide open for a casual snooper or a criminalhacker.

Current wireless protocols do not provide authentication mechanisms fordetermining if the AP is a valid AP or a rogue one, and the attackerstake advantage of this vulnerability. For example, when an 802.11 MSattempts to connect to a given network, it scans the environment andlooks for APs located nearby, automatically selects the best availableAP and connects with it; e.g. Windows XP connects automatically to thebest connection possible in the vicinity. At this point, wirelessprotocols include ways to authenticate the mobile, but not the AP. Dueto this behavior, authorized clients of one organization can connect toAPs from a neighboring organization. Though the neighbors APs have notintentionally lured the client, these associations can expose sensitivedata. The existence of the problem has been documented for GSM networksby Niemi and Nyberg (UMTS Security, Wiley, 2003) and for IEEE 802.16networks by Johnston and Walker, (Overview of IEEE 802.16 Security, IEEESecurity and Privacy Magazine, pp. 40-48, Vol. 2, 2004).

Rogue AP detection is a two step process starting with discovering thepresence of an AP in the network, and then proceeding to identifywhether it is a rogue one or not. Current methods for discovering thepresence of an AP can be classified into Radio Frequency (RF) scanning,AP scanning, or use of wired line inputs. RF scanning, which is suitablefor WLANs, is performed by placing RF sensors all over a wired network.These sensors, which are mainly re-purposed access point APs that onlyperform packet capture and analysis, detect any wireless deviceoperating in the area and can alert the WLAN administrator. However, arogue AP may be placed in a dead zone, which is not covered by thesensors, so that it might go unnoticed until more sensors are added.Also, these fixed sensors cannot detect directional rogue APs.

AP scanning implies deploying APs enabled with a scanning device fordiscovering all APs operating in a nearby area. Though it is a veryuseful feature, few AP vendors have this functionality implemented intheir products. In addition, the ability of an AP enabled with APscanning is limited to a very short range; rogue APs operating outsidethis coverage area will go unnoticed.

Generally, the network management software uses the wired side inputstechnique to discover APs, which may detect devices connected to a LAN(e.g. SNMP, Telnet, Cisco Discovery Protocol CDP, etc). This approach isreliable and proven as it can detect an AP anywhere in the LAN,irrespective of its physical location. Moreover, wireless NetworkManagement Systems (NMS) can in addition constantly monitor these APsfor health and availability. The limitation with this method is that anyAP that doesn't support the respective network management software willgo unnoticed by the network management software.

Once an AP is discovered, the next step is to identify whether it is arogue AP or not, which is not an easy task. One of the majordifficulties is presented by the fact that the method of attack dependson the type of network. In WiFi/802.11 networks, which uses carriersense multiple access, the attacker has to capture the identity of alegitimate AP in order to built a message using the identity of alegitimate AP. Once it captures such an authorized identity, the rogueAP waits until the medium is idle and then sends messages to the MS(s).

On a local plane, this problem is addressed by some administrators, whouse pre-configured lists with authorized MAC addresses for authorizedAPs, vendors, media types, or channels, and provide a tool whichautomatically advises of any newly detected AP that falls outside theauthorized. For example, M. K. Chirumamilla, et al. describe such atechnique in the paper entitled “Agent Based Intrusion Detection andResponse System for Wireless LAN”, IEEE International Conference onCommunications (ICC), 492-496, 2003. The paper proposes to check MACaddresses extracted from beacons of APs, for membership in such a listof registered APs. Failure to resolve the MAC address is interpreted asa rogue AP attack. This approach is however vulnerable to MAC addressspoofing. In addition, the lists must be updated and are sometimesoutdated, and thus unreliable.

Furthermore, rogue AP detection does not seem to be addressed in thecontext of WiMax/802.16 access networks. WiMax/802.16 is a nextgeneration wireless access network technology which is faster (speeds ofup to 70M bits per second), provides network coverage over a distance ofabout 50 km, offers better quality of service and is more secure thanprevious wireless technologies. Future WiMax products will supportmobile wireless connections; for example, Intel plans to integrate WiMaxsupport in notebook computers by 2006 and in mobile phones by 2007. Inview of the potential market size for the future WiMax market, and ofthe current trend of increase in attacks on network security, theproblem of rogue AP detection is an important aspect of secure WiMaxcommunication.

However, the rogue AP attacks are an important threat to these networks.In order to succeed, an attacker must be first armed with the identitycaptured from a legitimate AP, and transmit at the same time with thelegitimate AP. The attacker must also transmit a signal that arrives atthe targeted MS, i.e. has a receive signal strength (RSS) much strongerthan the signal received from any legitimate AP in the area. In thiscase, the MS receiver automatically reduces its gain in the presence ofthis strong illegitimate signal, to a point where the legitimate signalappears as background noise. The exact difference in strength betweenthe two signals depends on the receiver sensitivity.

In addition, with this technology, the mutual authentication of themobile and AP is optional and occurs late in the network access process.As well, security at the physical layer is absent. As such, a rogue APattack can occur at several points during a dialog between a MS and anAP in WiMax/802.16 access networks.

Other methods of establishing the legitimacy of an AP include thatproposed by Beyah et al. in a paper entitled “Rogue Access PointDetection using Temporal Traffic Characteristics” published in the Proc.of IEEE Global Telecommunications Conference (GLOBECOM), pp. 2271-2275,2004. The paper proposes an approach based on the analysis of thetemporal characteristics of the network traffic. It is based on theassumption that the wireless traffic is more random than the wiredtraffic. However, the method described in Beyah et al. paper proposesdiscovery of rogue APs by visual inspection of traffic plots, and is notautomated. Furthermore, assumptions on traffic characteristics are hardto validate in real networks.

In principle, the current solutions for detecting rogue APs areexpensive, rudimentary and easy to circumvent. Therefore, wirelessnetworks need efficient methods to detect the rogue APs in order toprevent malicious attacks.

SUMMARY OF THE INVENTION

It is an object of the invention to provide a system for detecting arogue AP in a wireless access network that alleviates totally or in partthe drawbacks of the existing rogue AP detection systems.

Accordingly, the invention provides a method for detecting a rogueaccess point (AP) in a wireless access network, comprising: a)maintaining at said each AP of said wireless access network, AP data forall APs in a service area; b) requesting, from a mobile station (MS)roaming in said service area, a handover from said serving AP to one ofa plurality of candidate APs in said service area; c) collecting, at theMS, AP presence information from all said candidate APs, and reportingsaid AP presence information to said serving AP; d) determining at saidserving AP if said AP presence information is consistent with said APdata maintained at said serving AP; and e) identifying said rogue APwhenever said AP presence information and said AP data are inconsistent.

According to another aspect for the invention, a method for detecting arogue access point (AP) in a wireless access network is provided. The i)preparing a Voronoi diagram that partitions a plane corresponding to aservice area into a plurality of convex polygons, each polygon includinga generating point representing the location of an AP in said servicearea, and every point in a given polygon being closer to its generatingpoint than to any other; and ii) computing for each polygon a minimumdistance and a maximum distance between any point of said respectiveconvex region and each other generating point in the Voronoi diagram andstoring said minimum and maximum distances.

Still further, the invention is directed to a method for detecting arogue access point (AP) in a wireless access network, comprising: p)maintaining at each AP of said wireless access network, AP data for allAPs in a service area; r) collecting, at a mobile station (MS) roamingin said service area, a data set including received signal strength(RSS) data for all APs in said service area, and reporting said data setto said serving AP; s) determining at said serving AP if said RSS datain said data set is consistent with said AP data maintained at saidserving AP; and t) identifying said rogue AP whenever said RSS data insaid data set and said AP data are inconsistent.

Advantageously, the method of the invention addresses vulnerabilities inthe security of the current wireless systems and can be used for anywireless technology and irrespective of the signal range of the rogueAPs. In particular, the system according to the invention can beintegrated with the new WiMax equipment. Also, the system and methodaccording to the invention enables an AP to detect, during the hand-overstage, a rogue AP deployed in the neighborhood without using directionalantennae and long range sensors.

Another advantage of the invention is that it enables the MSs to operateas mobile sensors to detect rogue AR Mobile equipment can detect andreport AP signals at the connection set-ups. Therefore, due to theirmobility, dead zone on the detection coverage would be eliminated. Evendirectional rogue APs are detectable with the invention.

BRIEF DESCRIPTION OF THE DRAWINGS

The foregoing and other objects, features and advantages of theinvention will be apparent from the following more particulardescription of the preferred embodiments, as illustrated in the appendeddrawings, where:

FIG. 1 illustrates a simple wireless network that includes a mobilestation according to an embodiment of the invention;

FIG. 2 shows a flowchart of the method of rogue access point detectionduring handover phase, the exact solution;

FIG. 3 shows how consistency of signals is determined on the flowchartof FIG. 2, where consistent signals are shown at (a) and in-consistentsignals are shown at (b);

FIG. 4 shows a flowchart of the method of rogue access point detectionduring handover phase, the fast test solution; and

FIG. 5 shows a flowchart of the method of rogue access point detectionwhilst the communication is active.

DETAILED DESCRIPTION

This invention is directed to determining the legitimacy of an accesspoint (AP) to a wireless network based on the consistencies in thereceived signal strength (RSS) reports from a mobile station (MS). Inparticular, it enables a MS with the help of a legitimate AP torecognize a rogue AP during the hand-over phase and/or whilst thecommunication is active. The invention is also concerned with using theMS as a mobile sensor, once the MS is in communication with a legitimateAP.

The term “hand-over” designates here the widely recognized operation ofswitching a call in progress from one AP to another, without disruptingthe communication. This procedure is used to provide seamless service toa MS when the subscriber is moving to/from the respective area ofcoverage. During the hand-over, a rogue AP may masquerade a legitimateAP, so that the mobile user will lose the connection with the accessnetwork. The term “communication” here is used to designate the exchangeof information between a MS and a remote entity after the MS gainedaccess to the network through a selected AP.

A wireless access network consists of a number of APs, providingattachment to roaming wireless MSs. The APs are connected together on aseparate backbone network which is used to exchange communicationinformation. By design, each MS tries to get attachment through the APthat presents the strongest RSS. The RSS value measured by the MS for acertain AP is relative to every MS, since the distance between the sameAP and two MSs is most probably different, and also since the MSs havemost probably different sensitivities.

FIG. 1 shows generically a wireless access network 150 that includes aMS according to an embodiment of the invention. The network in thisexample includes legitimate APs 10 and 10′, a rogue AP 100 and a MS 5that moves between the areas of coverage of these stations. Thelegitimate APs are connected to each other over a trusted physicalnetwork 150 and may also provide access to a wired network such as shownat 200. It is to be noted that only the units relevant to this inventionare illustrated on the block diagram of the MS 5 and AP 10.

As known, the APs and the mobiles are equipped with a transceiver 13,13′ with a receiver 16 and a transmitter 20 (shown for the MS 5 only)for enabling two-way communications between MSs and APs over theinterface 11, 11′, and a respective processor 15, 17. Processors 15 and17 generically illustrate all the functionality of the respective MS 5and AP 10 that enables data communication and signaling between themobiles and APs, and over network 200, including setting-up of aconnection, hand-over, data transfer (communication), and otherfunctionality that is not relevant as such to the invention.

In addition, all legitimate AP 10, 10′ in the access network are alsoequipped with a neighbor database 12 that stores the location data forall APs in the access network 150, or at least the location of theclosest neighbors. The AP location data may be determined in any knownway, e.g. through a backbone network protocol or by configuration. Thislocation information is kept in neighbors' database 12 in the form ofe.g. a table, where each row provides a AP identifier (the MAC address,a AP index), the location of the respective AP, and the effectiveisotopic radiated power (EIRP); other control information about therespective neighbors may also be kept in the table. We assume that thisinformation can be trusted.

According to the invention, the AP is also equipped with a APs locationassessment unit 14 which calculates the current APs location data basedon the information received from a mobile, such a MS 5 that roams withinthe area of coverage of AP 10. This APs location may be determined indifferent ways and at different stages of a call (hand-over or/andcommunication) in progress, as described in connection with FIGS. 2 to5. The current AP location data is compared then with the location datastored in memory 12; if the data are consistent, the APs are consideredlegitimate. If not, a rogue AP is present in the respectiveneighborhood.

MS 5 is equipped with an AP scanner 19 for detecting the signal strength(received signal strength RSS) of the signals received from the APs inthe respective area. Scanner 19 is shown as a separate unit, but ofcourse, it could be part of receiver 16. The mobile maintains a database22 that collects the RSS and direction information on the APs asdetected by scanner 19, during operation as a mobile sensor as discussedlater. In addition to the general tasks performed forestablishing/terminating a connection, handing-over the connection andthe ensuing signaling, processor 15 collects the AP information from thescanner 19 and stores it in database 22. This information is retrievedfor reporting, over transmitter 20, to the AP the mobile currently usesfor access (serving AP). Since the stations are mobile, thesecapabilities enable MS operation as a mobile sensor in the accessnetworks. As a result, the attackers would not be able to thwart thisdetection method simply by using directional antennas.

According to the invention, a MS makes a demand to its serving AP for atime interval during which the MS scans the frequencies and assesses theRSS of the available APs in the area; this is termed a scanning timeinterval. The serving AP replies to such a scanning interval demand withthe recommended AP identifications, retrieved from database 12, based anthe current location of the MS. During the scanning interval, the MSmeasures the RSS of the recommended APs. For example, the RSS isobtained by averaging the strength of the signal taken during thepreamble of a frame. Once scanner 18 collects all the measurements, theMS transmits to the serving AP a report including the identity of therespective AP paired with the measured RSS.

Rogue AP detection may take place according to the invention both duringthe hand-over phase of a mobile call and/or whilst the communication isactive. For rogue AP detection during the hand-over phase, the goal isto make sure that the signals received from a candidate APs for thehand-over phase are consistent with the real locations of thatcandidate. Whilst the communication is active, the goal is to detect andreport the presence of all APs in the area; in this way the MSs operateas a mobile sensor in the access networks.

It is to be understood that the invention is not restricted to theprocessing of the RSS for detecting rogue AP's. Any other presenceinformation that provides an indication of an AP operating in theroaming area of the MS, presence information that the mobile is able tocollect and report to a serving AP may be used.

Rogue AP Detection During the Hand-Over Phase

FIG. 2 shows a flowchart of the method of rogue AP detection duringhandover phase, illustrating the “exact solution”. Let's say that the MS5 of FIG. 1 connects to wireless 150 for communication with a fixedstation over network 200. Also, let's assume that MS 5 uses AP 10 as thecurrent AP and, as it leaves the area of coverage of AP 10, it looks forprospective AP able to seamlessly take-over the connection from AP 10.As seen in step 30, the MS 5 reports to the AP 10, all the APs thatindicated the availability to take-over the access functionalitycurrently performed by the serving AP 10.

The RSS measurements are then used at the serving AP to compute in step31 the effective path loss for the signal between the MS and therespective APs. The effective path loss is determined using the EIRP ofthe candidate AP from the database 12, the RSS for that AP reported bythe MS in step 30, and EQ1:

E=EIRP-RSS-G_(r)  EQ1

where G_(r) is the gain of the receive antenna of the MS.

As indicated above, the serving AP knows the location of the legitimateAPs, which is pre-stored in database 12. In some cases, the AP may alsoknow the current location of the MS. For example, if the MS is equippedwith a GPS, the MS can provide its location to the serving AR In thiscase the distance d_(i) between the MS and a candidate AP, can be usedto evaluate the expected path loss. This case is shown along branch“Yes” of decision block 32 of FIG. 2.

According to S. Rappaport and T. Rappaport book entitled “WirelessCommunications: Principles and Practice, 2^(nd) Edition, Prentice Hall,2001, the path loss L(d) in dB as a function of the distance d inmeters, is a random variable following a normal distribution, given byEQ2:

$\begin{matrix}{{L(d)} = {{\overset{\_}{L}\left( d_{0} \right)} + {10v\; {\log\left( \frac{}{_{0}} \right)}} + X_{\sigma}}} & {EQ2}\end{matrix}$

The term d₀ represents a reference distance close to the transmitter ofthe candidate AP The average loss measured at that distance is L(d₀).The value v, which is termed the path loss exponent, ranges from 1.5 to6. The path loss exponent captures the rate at which the strength of thesignal is fading, and is determined using sampling. The term X_(σ) is aGaussian distributed random variable in dB with zero-mean and standarddeviation σ. The distance is then used to calculate L(d), as shown instep 33.

It is known that the gap between L(d) and E is less than or equal to 2σwith a probability of 95%. This fact follows from the standard table ofthe normal distribution. It is therefore reasonable to expect that underattack, the calculated effective AP to MS path loss is much less thanthe average theoretical AP to MS path loss. Hence, the test fordetermining if a candidate AP is legitimate becomes:

|L(d)−E|≦2σ  EQ3

With this technique, the theoretical rate of false-negatives is about2.5%. The rate of the false positives depends on the additional RSSrequired by the attacker to succeed. In addition, if the AP usessectorized antennae then the azimuth of the MS must be within the sectorof the AP. If these tests fail, (which is highly improbable if the AP islegitimate), then the signal report for this AP should be consideredanomalous.

If the test of EQ3 is not satisfied, branch “No” of decision block 34,it means that the respective AP is a rogue one, and the serving basestation alarms the NMS of the presence of this rogue AP, step 35. If thetest in EQ3 indicates that the AP is legitimate, branch “Yes” ofdecision block 34, it means that the RSS data received from the MS areconsistent and the hand-over phase can choose any of the new reportedAPs, as seen in step 36. The serving AP then performs in step 37 thehandover to the respective candidate AP selected in step 36.

Estimation of the path loss becomes more complex if the location of theMS is not known, i.e. only the location of the candidate APs are known,as shown by branch “No” of decision block 32. In this case, thecalculation is preferably made using a geometrical representation of thesignal strength, as shown in step 38. The approximate position of the MSmay be represented as a disk, an annulus, a sector of a disk, a sectorof an annulus, a line segment, etc, depending on the number ofmeasurements for the respective prospective AP. Given a loss L thelog-normal shadowing model can be used to compute a distance estimate das:

$\begin{matrix}{d = {d_{0}10^{\frac{{L{(d_{n})}} - L}{10v}}}} & {EQ4}\end{matrix}$

Both loss L and distance d are random variables. The real distance fromMS to the candidate AP is within the interval delimited by a minimumvalue d_(min) and a maximum value d_(max) with a probability grater orequal to 95%. The minimum and maximum distances are calculated usingEQ5:

$\begin{matrix}{{d_{\min} = {d_{0}10^{\frac{{L{(d_{0})}} - L - {2\sigma}}{10v}}}}{d_{\max} = {d_{0}10^{\frac{{L{(d_{0})}} - L + {2\sigma}}{10v}}}}} & {EQ5}\end{matrix}$

The above EQ5 follows from the fact that 95% of the time the maximumdifference from the measured path loss and average path loss is 2 σ dB.It can be thus assumed that the MS is located with a probability of 95%in a region defined by an annulus centered at the location (s,y) of thecandidate AP and with radii of d_(min) and d_(max). In this case, acalibration phase is required to determine the average short distanceloss L(d₀), path loss exponent v and standard deviation σ.

Turning back to FIG. 2, following receipt of the RSS for each candidateAP in step 30, the serving AP determines the effective loss in step 31using EQ1. The MS to AP_(i) distance d_(i) is estimated using EQ4 withthe value of the effective loss used as the expected loss (L=E). Thed_(min) and d_(max) values are calculated using EQ5. Each AP_(i) definesan annulus A_(i) centered at the respective location (x_(i), y_(i)) andwith radii _(i,min) and d_(i,max).

The signal consistency is assessed in step 39 based on the intersectionof the annuli, as also shown in the examples of FIG. 3. If the annulifor all candidate APs have a non-empty intersection, as in FIG. 3( a),it means that there is an area (the intersection) where it is plausiblefor the MS to be located, because the RSS received for the APs in theneighborhood are consistent.

The detection may be further simplified by using in step 38 only thed_(i,max) values. Each AP defines also a disk D_(i) of radius d,_(i,max)centered at location (x_(i) y_(i)); FIG. 3 illustrates an example of anormal case and an anomalous case. In the normal case, the disks have anon-empty intersection and signal reports agree on a common area inwhich the MS should be located. In the anomalous case, the attackerimitates AP₂ with a substantially stronger RSS. This leads to the falseinterpretation that the receiver is much closer to AP₂ that it is inreality. Signal reports don't agree on a common area in which the MSshould be located.

If the AP uses sectorized antennae, then the intersection of sectorsmust be verified instead of annuli or disks.

As indicated above, in order to uncover a rogue AP, the APs locationassessment unit 14 of the AP 10 performs an intersection of allgeometric representations (annuli, or circles, or sectors, etc) computedin step 38 for the respective candidate APs, as shown in step 39.Verification of disk, annulus and sector intersection can be performedby resolving a set of respective equations to find a solution(x_(i),y_(i)) for the position of each AP.

If the intersection of the geometric representations is not empty,branch “Yes” of decision block 39, it means that the RSS data receivedfrom the MS are consistent and the hand-over phase can choose any of thenew reported APs, as seen in step 36. Now, the handover may proceed andthe closest candidate AP becomes the new serving AP. FIG. 3( a) shows anexample when the signals are consistent.

If on the other hand the signals are not consistent, as shown in FIG. 3(b) and by branch “No” of decision block 39, the AP will raise an alarmsignal to the network management system (not shown), as indicated instep 40. In order to determine which of the prospective APs is the rogueAP, the serving AP attempts to determine a maximal cardinality subset ofthe geometric representations which have a non empty intersection.Assuming there is only one rogue AP in the list, one AP is simpleselected from the list, removed, as shown in step 41 and the commonintersection of the remaining geometric representations is computedagain, step 42. If the common intersection is still empty, replace therelated AP in the list and remove another AP from the initial list.Steps 41-42 are repeated until the signals become consistent, in whichcase the last removed AP is the rogue one, as shown in step 25. Thehand-over may be refused altogether at any time if the distances are notconsistent.

It is to be noted that other ways of determining which AP introducesdiscrepancies in the distances. For example two or more APs may beremoved simultaneously from the list rather than one, or the serving APmay use some selection criteria for selecting the order of AP removalfrom the list, etc. Such strategies may attempt e.g. to speed the rogueAP detection process, or to identify the rogue AP with more accuracy,etc.

Since detection of a rogue AP must be completed during a communicationhand-over period, a faster solution may be used. While this fastsolution is not very accurate, it may however be used in conjunctionwith the exact solution to eliminate some of the worst rogues. The fastsolution relies on a pre-processing step which uses a Voronoi diagram.This diagram provides partitioning of a plane with n generating pointsinto convex polygons such that each polygon contains exactly onegenerating point, and every point in a given polygon is closer to itsgenerating point than to any other generating point. The known locationsof the trusted APs are used as generating points. The correspondingVoronoi diagram is invariant while the network topology is fixed and canbe pre-computed in time complexity O(nlogn).

FIG. 4 shows a flowchart of the method of rogue AP detection duringhandover phase, fast test solution. In step 43, the serving AP computesthe Voronoi diagram of the points representing the location of the APspre-stored in memory 12. As shown for the loop 44-47, for each convexregion of the Voronoi diagram, the AP computes the minimum and themaximum distances between any point of this convex region and each othergenerating point. The distances are stored in database 12 for eachconvex region.

As in the example shown in FIG. 2, the MS reports to the serving AP theRSS for each candidate AP step 47. In step 48, the AP calculates theapproximate distance between the current location of the MS and thecandidate AP, based on the characteristics of the APs and the measuredRSS. These approximations define distance ranges. In step 49, theserving AP identifies a candidate AP_(i) which is supposed to be theclosest one to the current location of the MS. The shortest distanced_(i) enables the serving AP to determine the corresponding convexregion on the Voronoi diagram in which the MS should be. Next, in step51 AP determines if the distance ranges determined in step 45 for AP_(i)are consistent with the distances computed in step 49. If the distancescorrespond, branch “Yes” of decision block 51, than the handover isperformed in step 61. Otherwise, the exact solution may still beexecuted now for a more accurate determination.

If not, branch “No” of decision block 51, the AP raises an alarm, shownin step 53 to the network management system of the access network. Then,the serving AP attempts to determine a maximal cardinality subset of APwhich have coherent distances. Assuming there is only one rogue AP inthe area, one AP is randomly selected and removed, step 55. For example,this could be the closest candidate AP identified in step 49. Thecandidate base station that is now the closest one to the MS isdetermined as before, and the corresponding convex polygon for the newclosest candidate AP is identified, in step 57. If the distances are notcoherent, decision block 59, the chosen AP is again replaced and anotherAP is removed; steps 55, 57 and 59 are repeated until the distancesbecome consistent. In this case, the last removed AP is identified asthe rogue AP, step 25. The hand-over may be refused altogether at anytime if the distances are not coherent.

It is to be noted that other ways of determining which AP introducesdiscrepancies in the distances may be used. For example two or more APsmay be removed simultaneously from the list rather than one, or theserving AP may use some selection criteria for selecting the order of APremoval from the list, etc. Such strategies may attempt e.g. to speedthe rogue AP detection process, or to identify the rogue AP with moreaccuracy, etc.

Rogue AP Detection Whilst the Communication is Active

FIG. 5 shows a flowchart of the method of rogue AP detection whilst thecommunication is active. Once a mobile user has been established acommunication with a legitimate AP, the AP may want to detect anypotential rogue APs reported by the mobile user. In such a case, the MSsbecome mobile sensors trying to detect rogue APs in the access networks.Evidently, there is no real need of a fast test at this stage of theconnection, so that the detection process can be done off-line theAP—mobile user communication establishment.

The mobile collects the RSS from all the APs in the area and reportsthis information to the serving AP, step 50. It is to be noted that step50 is performed continuously, as the mobile roams within the servicearea of AP, as shown by dotted line on the flowchart of FIG. 5. Thereports include the information collected by the MS for all APs in therespective area and may be made periodically, or when requested by theserving AP; other arrangements may equally be envisaged. The informationincludes at least a data set with an identification of the respectiveAPs and the corresponding RSS (e.g. AP1-RSS1; AP2-RSS2 . . . APn-RSSn).The time when the respective data set has been collected may also berecorded.

For each data set reported by the mobile user, the serving AP computesthe approximate location of the mobile user, step 52. This determinationis performed based on the characteristics of the respective candidate APand the strength of the signal received by the mobile user. Theapproximate location of the MS with respect to the AP can be representedas before using a geometrical representation, such as a disk, anannulus, a sector of a disk, a sector of an annulus, a line segment.

Next, the serving AP determines for a given data set, if the RSSsreceived from the MS are consistent with its knowledge of the legitimateAPs in the respective area. This is done by intersecting all thegeometric representations computed in step 52. If the intersection isnot empty, it means that the signals of the given data set received fromthe MS are consistent and no reported AP seems to be a rogue one. Asshown by branch “Yes” of decision block 56, steps 50, and 56 arerepeated for each data set reported by the MS.

If on the other hand the signals in the given data set are notconsistent, as shown by branch “No” of decision block 56, the serving APraises an alarm to the network management system, step 58. Then, theserving AP attempts to determine the identity of the rogue AP bydetermining the maximal cardinality subset of the geometricrepresentations which have a non empty intersection, as described above.

Each legitimate AP uses this method to monitor the access network. If agiven AP is reported too often and, eventually, by too many APs, thecentral network management acts accordingly and asks to all legitimateAPs in the access network to identify the corresponding AP as at risk.Furthermore, the network management systems through the legitimate APscan download a black list of the at risk AP identifiers in the MSs.Then, the APs and the MSs can implement some security policies such asuse an at risk AP only if no other possibility.

1-18. (canceled)
 19. A method for detecting a rogue access point (AP) ina wireless access network, comprising: computing, with a serving AP, aVoronoi diagram that partitions a plane corresponding to a service areainto a plurality of convex polygons, each polygon including a generatingpoint representing the location of an AP in said service area, and everypoint in a given polygon being closer to its generating point than toany other; and computing, with the serving AP, for each polygon aminimum distance and a maximum distance between any point of saidrespective convex region and each other generating point in the Voronoidiagram and storing said minimum and maximum distances.
 20. The methodof claim 19, further comprising; requesting, from a mobile station (MS)roaming in said service area, a handover from a serving AP to one of aplurality of candidate APs in said service area; determining anapproximate distance between each said candidate AP and said MS based onAP presence information collected by said MS; determining a shortestdistance from said approximate distances and identifying, based on saidshortest distance, a closest candidate AP; identifying on the Voronoidiagram a convex polygon corresponding to said shortest distance; anddetermining if said approximate distance for said closest AP isconsistent with the minimum distance and the maximum distance for saidclosest candidate AP.
 21. The method of claim 20, wherein said APpresence information for a candidate AP includes received signalstrength (RSS) data associated with an identification of a respectivecandidate AP.
 22. The method of claim 21, further comprising:identifying said rogue AP whenever said approximate distances are notconsistent with the minimum and maximum distances for said closestcandidate AP.
 23. The method of claim 22, wherein identifying the rogueAP further comprises: a) selecting a candidate AP and removing saidselected candidate AP from said Voronoi diagram; b) determining a newshortest distance from said approximate distances and identifying, basedon said new shortest distance, a new closest candidate AP; c)identifying on the Voronoi diagram a new convex polygon corresponding tosaid new shortest distance; and d) determining if said approximatedistances are consistent with the minimum and maximum distancescalculated for said new closest candidate AP; and e) advising said MS touse any of said candidate APs but said selected candidate AP if saidapproximate e distances are consistent with the minimum and maximumdistances calculated for said new closest candidate.
 24. The method ofclaim 22, further comprising: replacing said selected candidate AP withanother candidate AP; and repeating steps a) to e) until saidapproximate distances for said new closest candidate AP are consistentwith said minimum and maximum distances.
 25. The method of claim 20,further comprising: enabling said MS to perform a handover to saidclosest candidate AP if said approximate distances are consistent withsaid minimum and maximum distances. 26-33. (canceled)